EUVD-2026-76938
GHSA-h6w4-32pj-q5p4
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local low-privileged attacker exploits kernel driver IOCTL with no complexity; scope changes to OS kernel level enabling full system takeover.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp.sys of the component Kernel Driver. The manipulation results in improper access controls. Attacking locally is a requirement. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Local privilege escalation in Tonec Internet Download Manager (IDM) versions up to 6.42 Build 63 on Windows allows a low-privileged local attacker to gain full SYSTEM-level kernel control by exploiting improper access controls in the idmwfp.sys kernel driver (CWE-284). A public proof-of-concept exploit is available on GitHub under the repository name IDM_LPE_PoC, substantially lowering the barrier to exploitation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have a local Windows user session (low-privilege OS account is sufficient) on a system where Internet Download Manager version 6.42 Build 63 or earlier is installed and the idmwfp.sys kernel driver is loaded. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H/SC:H/SI:H/SA:H and E:P reflects a reliable, low-complexity local privilege escalation with kernel-scope impact, and the E:P modifier confirms a public proof-of-concept exists. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch is identified at time of analysis - the vendor did not respond to responsible disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running IDM versions 6.42 Build 63 or earlier and determine business criticality of each. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Internet Download Manager
View allTonec Internet Download Manager 6.42.41.1 and earlier suffers from Missing SSL Certificate Validation, which allows atta
Internet Download Manager 6.38.12 contains a buffer overflow vulnerability in the Scheduler component that allows local
Same weakness CWE-284 – Improper Access Control
View allShare
External POC / Exploit Code
Leaving vuln.today